diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..cafd44f
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,38 @@
+name: Build
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: build-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Lint and build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          # ESLint 10 uses Node util.styleText, and jsdom 30 requires Node 22+.
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint site
+        run: npm run lint
+
+      - name: Build site
+        run: npm run build
+        env:
+          NEXT_PUBLIC_BRANCH: main
diff --git a/.github/workflows/meeting-recordings-refresh.yml b/.github/workflows/meeting-recordings-refresh.yml
index 6332058..1f52610 100644
--- a/.github/workflows/meeting-recordings-refresh.yml
+++ b/.github/workflows/meeting-recordings-refresh.yml
@@ -6,24 +6,26 @@ on:
     - cron: '17 12 * * *'
 
 permissions:
-  contents: write
+  contents: read
 
 env:
   NETLIFY_BUILD_HOOK_URL: ${{ secrets.NETLIFY_BUILD_HOOK_URL }}
 
 jobs:
   refresh:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20.11.1'
           cache: npm
       - run: npm ci
       - run: npx tsx scripts/update-meeting-recordings.ts
       - name: Commit recording feed snapshot
-        uses: stefanzweifel/git-auto-commit-action@v6
+        uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
         with:
           commit_message: 'docs: refresh community meeting recordings'
           file_pattern: data/meeting-recordings.json
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index df06c27..7191565 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -9,3 +9,25 @@ Thank you for helping improve the Hive Commons documentation site
 - Site code, navigation, and layout changes belong in this repository.
 - Sign your commits with the DCO: `git commit -s`.
 - Open an issue at https://github.com/hivecommons/docs/issues for anything unclear.
+
+## Before you open a PR
+
+From a fresh checkout, install the exact dependency set and run the same local
+validation commands used by CI:
+
+```bash
+npm ci
+npm run lint
+npm run build
+```
+
+To preview the docs locally while editing, run:
+
+```bash
+npm run dev
+```
+
+Then open the local URL printed by Next.js, usually
+<http://localhost:3000>. For a production-style preview, run
+`npm run build` followed by `npm run start`.
+